1 unstable release
0.1.0 | Jun 14, 2023 |
---|
#858 in Unix APIs
420KB
310 lines
YAUI
Yet Another freaking Unix Injector!
- Support for arm, aarch64, i386/x86, x86_64.
- Supports for Android bionic linker!
- Kinda Supports Android Emulators
How
By using ptrace-do we can invoke remote functions in unix processes. We apply the same window load library injection technique of using the operating system's normal dynamic object load system. Refer to libc's dlopen
Build
git clone https://github.com/ohchase/yaui
cd yaui
cargo build
./target/debug/yaui --pid 777 --payload evil.so
android ish
git clone https://github.com/ohchase/yaui
cd yaui
cross build --target aarch64-linux-android
adb push target/aarch64-linux-android/debug/yaui /data/local/tmp
adb shell "su -c 'chmod +x yaui'"
Gotchas
Injecting on android has gotchas due to SE-Linux. If you just inject a typical shared object from /data/local/tmp into an app, it won't map an executable section of the payload. The payload will be visible in the app's proc maps but won't have had its ctor called.
Fadeevab found a solution for this; allllll the way at the bottom :)
https://fadeevab.com/shared-library-injection-on-android-8/
SELinux Label for Injection Library
The final step is to overcome SELinux that denies to mmap a shared library from /data. Use the same trick with a label as before:
chcon -v u:object_r:apk_data_file:s0 /data/local/tmp/libinject.so
Usage sample
By Process Name
yaui --target host-process --payload /target/debug/libpayload.so
By Process Identifier
yaui --pid 777 --payload /target/debug/libpayload.so
Output sample
aarch64-linux-android injection
gta7litewifi:/data/local/tmp # ./yaui --pid 3615 --payload libpayload.so
21:58:46.796938Z INFO yaui: Yaui: Yet another unix injector!
21:58:46.813933Z INFO yaui: Target payload: libpayload.so
21:58:46.814144Z INFO yaui: Target pid for injection: 3615
21:58:47.076213Z WARN yaui: Using injection configs: InjectConfig {
spoof_so_path: "/apex/com.android.runtime/lib64/bionic/libc.so",
allocater_so_path: "/apex/com.android.runtime/lib64/bionic/libc.so",
linker_so_path: "/apex/com.android.runtime/lib64/bionic/libdl.so",
}
21:58:47.076937Z INFO yaui: Injecting Payload: "/data/local/tmp/libpayload.so" into Pid: 3615
21:58:47.077242Z INFO yaui: Successfully attached to the process
21:58:47.080813Z INFO yaui: Identifed internal range "/apex/com.android.runtime/lib64/bionic/libc.so" at 7C19F4E000
21:58:47.206350Z INFO yaui: Identifed remote range "/apex/com.android.runtime/lib64/bionic/libc.so" at 7637688000
21:58:47.206574Z INFO yaui: Identified remote mmap procedure at 7637760400
21:58:47.210182Z INFO yaui: Identifed internal range "/apex/com.android.runtime/lib64/bionic/libdl.so" at 7C19F09000
21:58:47.336861Z INFO yaui: Identifed remote range "/apex/com.android.runtime/lib64/bionic/libdl.so" at 763BA16000
21:58:47.337073Z INFO yaui: Identified remote dlerror procedure at 763ba17030
21:58:47.340718Z INFO yaui: Identifed internal range "/apex/com.android.runtime/lib64/bionic/libdl.so" at 7C19F09000
21:58:47.468265Z INFO yaui: Identifed remote range "/apex/com.android.runtime/lib64/bionic/libdl.so" at 763BA16000
21:58:47.468540Z INFO yaui: Identified remote dlopen procedure at 763ba17018
21:58:47.594403Z INFO yaui: Identified spoof module base address for return address: 7637688000
21:58:47.594596Z INFO ptrace_do: WaitStatus { is_stopped: true, is_signaled: false, is_continued: false, is_exited: false, stop_code: 19 }
21:58:47.594681Z INFO yaui: Successfully waited for the mmap frame
21:58:47.595591Z INFO ptrace_do: WaitStatus { is_stopped: true, is_signaled: false, is_continued: false, is_exited: false, stop_code: 11 }
21:58:47.595810Z INFO yaui: Mmap was successful created new mapping at 763cb5d000 with size 1000
21:58:47.596081Z INFO yaui: Successfully wrote payload location to 763cb5d000
21:58:47.600293Z INFO ptrace_do: WaitStatus { is_stopped: true, is_signaled: false, is_continued: false, is_exited: false, stop_code: 11 }
21:58:47.600665Z INFO yaui: Executed remote dlopen function
21:58:47.600783Z INFO yaui: Successfully executed remote dlopen function
21:58:47.600888Z INFO ptrace_do: Successfully detached from Pid: 3615
Showcase
- Yaui to inject shared object payload
- Plt-rs to crawl link maps on android/linux to hook eglSwapBuffers
- EGui and Glow renderer
Dependencies
~0.8–9MB
~85K SLoC